Fixes out of array accesses
Fixes: ffmpeg_mjpeg_crash2.avi
Found-by: Thomas Lindroth <thomas.lindroth@gmail.com>
Tested-by: Thomas Lindroth <thomas.lindroth@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e3201c38d53d2b8b24d0bc95d726b2cb1752dc12)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes out of array read
Fixes: asan_heap-oob_4d2250_814_cov_2745172097_JACOsub_capability_tester.jss
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3d5d95db3f5d8e2093e9e19d0c46e86f54ed2a5d)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes an "initialization discards qualifiers from pointer target type" warning.
(cherry picked from commit f05855414ed4cce97c06ba2a31f4987af47e6d4e)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes: out of array accesses
Fixes: asan_heap-oob_112c6b3_13_012.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit df74811cd53e45fcbbd3b77a1c42416816687c5c)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes out of array accesses
Fixes: asan_heap-oob_12304aa_8_asan_heap-oob_4da4f3_300_intro.jv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 105654e376a736d243aef4a1d121abebce912e6b)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes Ticket3869
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3fe9e7be4c70c8fccdcd56fd19276e668cfb7de8)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This limits ABI issues in case libavcodec is linked to a libavutil with larger AVFrame
Which can happen if they are shiped in seperate binary packages and libavutil is upgraded
A cleaner alternative would be to replace them by pointers but this would likely cause
a small speedloss
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit fc567ac49e17151f00f31b59030cd10f952612ef)
Conflicts:
libavcodec/h264.h
This is a bit tricky, we allocate a correctly sized AVFrame but then only
copy the compile time AVFrame size, this is to ensure that user applications
which do not use the correct av frame API dont end with out of array reads.
Note, applications using the correct API have set extended_data and the
changed code will never be executed for them.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8ab80707841a73ca7708e1e1aa97f3513fff3d35)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes inconsistency and out of array accesses
Fixes: 10cdd7e63e7f66e3e66273939e0863dd-asan_heap-oob_1a4ff32_7078_cov_4056274555_mov_h264_aac__mp4box_frag.mp4
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e5c7229999182ad1cef13b9eca050dba7a5a08da)
Conflicts:
libavcodec/utils.c
(cherry picked from commit 4f94e1901a1ff0073c64122c577b6efd3dee22d4)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
about 1ms faster startup time
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 133fbfc7811ffae7b97dd129fcd0b5e646742362)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This code changes the input packet, which is read only and can in
rare circumstances lead to decoder errors. (i run into one of these in
the audio decoder, which corrupted the packet during av_find_stream_info()
so that actual decoding that single packet failed later)
Until a better fix is implemented, this commit limits the problem.
A better fix might be to make the subtitle decoders not depend on
data[size] = 0 or to copy their input when this is not the case.
(cherry picked from commit 01923bab98506b1e98b4cbf08419364ce6ffea6d)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This fixes potential overreads with crafted files.
Found-by: wm4
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 838f461b0716393a1b5c70efd03de1e8bc197380)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
The to_free AVframe must be freed just like the other ones.
Indeed, the calling application may expect all frames to be
released.
(This regression caused use-after-free in VLC with hwaccel.)
Signed-off-by: Rémi Denis-Courmont <remi@remlab.net>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
* commit '799f57ac96f9891d1a0f7d6c4b218ed536e8aca5':
lavc: use AVFrame API properly in pad_last_frame().
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Those were useful when avcodec_thread_init() was a public functions. It
was deprecated and removed some time ago, so those checks are not needed
anymore.
* commit '252c0bfdc014c1fb6ad4fe06242c7beca58a6b41':
lavc: Fix msvc compilation of utils.c with -WX (warnings treated as errors)
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'e55e8b2c362a60bad66929d83d8c83b0d7f5ffc9':
lavc: do not leak frames in avcodec_decode_audio4
Conflicts:
libavcodec/utils.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '088f38a4f9f54bb923405c67c9e72d96d90aa284':
avcodec: Drop unnecessary ff_ name prefixes from static functions
Conflicts:
libavcodec/ass.c
libavcodec/h264_parser.c
libavcodec/utils.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'e036bb7899d0faca9159206be9bf5552e76e7633':
lavc: clear AVBuffers on decoded frames if refcounted_frames is not set
FATE: add an additional indeo3 test
Merged-by: Michael Niedermayer <michaelni@gmx.at>
